topic Re: Cisco ISE edit EndPoint error in Network Access Control

Cisco ISE edit EndPoint error

albertofdez — Sat, 15 Oct 2022 13:19:22 GMT

Hi,

I have 2 Cisco ISE in HA in version 3.0 Patch4 and since a few days ago every time I enter the EndPoint classification and try to edit one of them to modify the description, I get an error.

It says this

The error pops up because the Attribute Value field is empty and therefore says that it is not valid, but this is not true because when I enter the EndPoint it tells me that it has the Xerox-Device profile applied.

I see that now when I edit an EndPoint in the bottom part the custom attributes appear and when I display it, it does not have any value, but whatever I put gives error.

Why does this custom attribute appear if I have not chosen it and why before I did not get this error when modifying the description?

Regards

Re: Cisco ISE edit EndPoint error

thomas — Sun, 16 Oct 2022 18:37:57 GMT

See my recent ISE Webinar ▶ User & Endpoint Custom Attributes where I show how to create, use, and edit the attributes.

07:36 Demo: Creating User Custom Attributes
10:41 Demo: ISE 802.1X Policy Review, and Authentication
13:51 Demo: Customize 802.1X Authorization Policy using Custom Attributes
15:20 Demo: Edit User Custom Attribute and Authenticate with Custom Attribute
16:51 Demo: Endpoint Custom Attributes
19:29 Demo: Custom Attribute Policies for IOT Endpoints

I also do not know how you defined the custom attribute - did you specify a String or some other data type which would be invalid as a text string?

I assume you are saving the attribute value with the ✔ in Context Visibility after editing it.

Re: Cisco ISE edit EndPoint error

albertofdez — Mon, 17 Oct 2022 08:21:38 GMT

Hi Thomas,

I don't want to define any custom attribute, I just want to change the description of the EndPoint but it forces me to have to define it because otherwise I get this error

Even so, as you can see in the other image, the value that I try to put to continue is the same that Xerox-Device has detected and I press the ✔ button to save the data and it says "Error saving item: EndPointPolicy", I tried to write any text and I get the same error.

Thanks.

Re: Cisco ISE edit EndPoint error

davidgfriedman — Mon, 17 Oct 2022 19:41:05 GMT

I'm a logical guy so I'd like to know:

1. How long you've had a Custom Attribute named EndPointPolicy, which clearly conflicts with the normal ISE field of the same name: EndPointPolicy

2. What version you created that Custom Attribute under, because my ISE v2.7p6 stops prevents me from creating any Custom Attribute if the name conflicts with an existing Cisco field. (Just lab verified this) What is stopping you from deleting it under the page Administrator->Identity Management->Settings->Endpoint Custom Attributes to there is no conflict?

3. Why are you even using a custom attribute for EndPointPolicy? The normal edit of the endpoint allows you to set the field to any valid profile name you created under Policy->Profiling->Profiling Policies

Regards,
David

Re: Cisco ISE edit EndPoint error

albertofdez — Mon, 17 Oct 2022 22:03:28 GMT

Hi David,

1. As you can see in the attached image, I have not created any custom attribute called EndPointPolicy, the one created is the default one

2. The deployment was performed on ISE 3.0 version and has patch 4 applied, it is not migrated from any version

3. I don't want to edit or create any EndPointPolicy, I just want to add a description to an EndPoint

Thank you very much for your help, but if you look at my first message, you will see that these questions were already answered and what is the error I get. Maybe I am not explaining myself well, but in the images you can see what I want to do and the errors I get.

I have been using ISE 3.0 Patch 4 for a year and I have been editing EndPoints to add the description for almost a year and this error has appeared a week ago.

Regards.